mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-11-10 05:08:36 +02:00
6f189d4d98
Automatic update from web-platform-tests [LayoutNG] LayoutNGInsideListMarker inline splitting Fuzzer caught a NULL deref crash. Running with DCHECK, found a problem before the deref, we were cloning LayoutNGInsideListMarker inside LayoutInline::SplitInlines. This was triggering a DCHECK in LayoutInline::Clone. I am not very familiar with how LayoutInline line splitting works. I have a patch created with my shallow understanding that fixes the crash, but I am not sure if this is the right thing to do. Bug: 962242 Change-Id: I11e4cf3307c257e7c396b4112888bad0cd76ac5a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1610522 Commit-Queue: Aleks Totic <atotic@chromium.org> Reviewed-by: Emil A Eklund <eae@chromium.org> Cr-Commit-Position: refs/heads/master@{#659286} -- wpt-commits: fb0fcf965fb9e0bed4264225a5b20ca53e382020 wpt-pr: 16807
21 lines
610 B
HTML
21 lines
610 B
HTML
<!DOCTYPE html>
|
|
<title>CSS Inline: Chrome crash with split inlines</title>
|
|
<link rel="author" href="mailto:atotic@google.com">
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=962242">
|
|
<meta name="assert" content="Chrome crashes on split inlines">
|
|
<style>
|
|
.first-line::first-line {
|
|
font-size: larger;
|
|
}
|
|
</style>
|
|
<div class="first-line">
|
|
<ol style="list-style-position: inside">
|
|
<li>
|
|
<tag>
|
|
<div></div>
|
|
<script>
|
|
test(() => {
|
|
}, 'did not crash');
|
|
</script>
|